Merge remote-tracking branch 'origin/main' into feat/wake-914-digest-render

# Conflicts:
#	packages/mosaic/framework/tools/wake/manifest.txt

packages/mosaic/framework/tools/wake/manifest.txt

@@ -24,7 +24,17 @@
 #              alarm-target/HMAC-key install-validation. Also folds in the two W6
 #              monitor-integration observations (monitor-side ingested_ts
 #              staleness + beacon HMAC-verify at record).
-#   0.6.1  #914 digest.sh renderer fixes (live wake-pilot findings): (a) the
+#   0.6.1  #908 — UNIFY observed_seq on a SINGLE store-side allocator. store.sh
+#              enqueue is now the sole allocator (reads its own cursor, next=+1
+#              under an exclusive lock, prints the seq; commits IFF the durable
+#              write succeeds). The detector-private observed_seq_counter and its
+#              --seq hand-off are DELETED; the reconciler enumerates via the same
+#              store allocator (its dual-allocator fail-closed guard retired). This
+#              dissolves the three defects rooted in the private-counter seam:
+#              burn-before-enqueue (arrow 1), W5 co-feed aliasing (arrow 2), and
+#              the migration-restart silent-swallow (arrow 3, now structurally
+#              impossible — allocation is always > consumed or fails loud).
+#   0.6.2  #914 digest.sh renderer fixes (live wake-pilot findings): (a) the
 #              embedded ack copy-run line now bakes an explicit
 #              WAKE_AGENT=<render-time-agent> prefix (shell-quoted) so an
 #              env-less copy-run resolves to the correct per-agent namespace
@@ -36,7 +46,7 @@
 #              empty. Display-only: the ACTIONABLE-tier hard-locator FAIL-LOUD
 #              gate (_has_hard_locator, exit 4) is unchanged.
 component=wake
-version=0.6.1
+version=0.6.2
 
 # Watch-list schema this component consumes, and the INCLUSIVE range of
 # schema_version values it supports. A wake-watch-list.json whose schema_version
@@ -54,8 +64,9 @@ schema_max=1
 #   sign.sh     A5 — non-circular HMAC signer (independent wake_id,
 #                    load_credentials by-name; fills the hmac placeholder). (W3)
 #   detector.sh A1 — per-host single-instance delta-gated detector daemon
-#                    (flock, anchor-scoped hashing, detector-local observed_seq,
-#                    fail-loud source semantics; enqueues deltas to store.sh). (W4)
+#                    (flock, anchor-scoped hashing, fail-loud source semantics;
+#                    enqueues deltas to store.sh and captures the store-allocated
+#                    observed_seq — no private counter, #908).                 (W4)
 #   fn-oracle.sh A6 — synthetic-canary FN-oracle: injects a KNOWN delta at the
 #                    source boundary, drives the pipeline through the detector's
 #                    public poll-once, asserts CONSUMED within the per-class SLO
@@ -64,7 +75,9 @@ schema_max=1
 #   reconcile.sh A7 — source-parity reconciler: (i) source-coverage parity
 #                    inventory (an omitted source cannot pass the vector
 #                    vacuously) + (ii) periodic full reconcile to 0-unaccounted,
-#                    enumerating pre-existing/startup state into the store.   (W5)
+#                    enumerating pre-existing/startup state into the store via the
+#                    SINGLE store-side allocator (co-feed is safe; the former
+#                    dual-allocator fail-closed guard retired, #908).         (W5)
 #   beacon.sh   A8 — off-host DEAD-MAN liveness beacon: a monotonic beacon
 #                    EMITTER (emit — the primitive the detector run-loop calls
 #                    each cycle), the off-host monitor's RECEIVER + beacon-ABSENCE